EP3423985B1

EP3423985B1 - Techniques for protecting security features of integrated circuits

Info

Publication number: EP3423985B1
Application number: EP17760462.6A
Authority: EP
Inventors: Bruce Pedersen; Ting LU; Brian Wong; Alok DOSHI; Yun Sum WONG
Original assignee: Altera Corp
Current assignee: Altera Corp
Priority date: 2016-03-04
Filing date: 2017-02-10
Publication date: 2023-08-23
Anticipated expiration: 2037-02-10
Also published as: CN108604282A; EP3423985A4; US20170257222A1; US10095889B2; US20190026497A1; CN108604282B; WO2017151294A1; EP3423985A1; US10657291B2

Description

FIELD OF THE DISCLOSURE

The present disclosure relates to electronic circuits and systems, and more particularly, to circuits and methods for protecting security features of integrated circuits.

BACKGROUND

A field programmable gate array (FPGA) is an integrated circuit that has programmable logic circuits and programmable routing circuits. The programmable logic and routing can be configured with a configuration bitstream that is loaded into the FPGA from an external source. An FPGA may also have a test mode that is used by the manufacturer of the FPGA to check that the FPGA is fully-functional before being sold, and also used to perform failure analysis on an FPGA returned from the field. Test mode often provides greater access and control over elements in the FPGA than the access and control provided to an ordinary user through the bitstream. An FPGA may contain a fuse that can be used to permanently disable test mode access or to prevent the programming or read-back of encryption keys.
US 2014/0137271 A1 relates to data security and access tracking in a memory deivce. The memory device includes but is not limited to a substrate, a non-volatile memory array integrated on the substrate, and data security logic integrated with the non-volatile memory array on the substrate. The data security logic is operable to perform at least one data security function associated with the non-volatile memory array.
US 2010/0174848 A1 dislcoses a data processing apparatus which comprises a monolithic integrated circuit having a data processor, a non-volatile memory storing at least one security code, and at least one interface at the boundary of the integrated circuit via which communication with the data processor can occur. Processing by the data processor of data received at the at least one interface is controlled by the at least one security code.
GB 2331821 A discloses an electronic sealed envelope. Restricted data is stored on e.g. a smart card having a memory and a processor. Preferably the restricted data is stored in groups. The smart card may store a record of users authorized to access certain groups of restricted data. An owner of the smart card must authorize registration of new users by entering their password, the new users are then given their own passwords in order to retrieve certain groups of restricted data. When a registered user uses his password to retrieve restricted data the smart card irretrievably modifies a codeword of the restricted data group, each codeword corresponding to an authorized user. The owner of the smart card is then able to determine if the restricted data has been accessed by checking for modified codewords.
US 2011/0141791 A1 discloses a system and a method to control a one-time programmable memory. A device includes the one-time-programmable memory including multiple random accessible input/output pins. Each random accessible I/O pin corresponds to a unique memory address in the one-time-programmable memory. The device also includes a multiplexing circuit with multiple inputs. Each of the multiple inputs is coupled to one of the multiple random accessible I/O pins. An output of the multiplexing circuit has a bit width that is less than the number of the multiple random accessible I/O pins.
US 2015/0082420 A1 relates to security certificates for system-on-chip (SoC) security. The SoC includes multiple hardware modules that are implemented on a substrate. The hardware modules include a plurality of hardware and software security features and the SoC provides one or more external interfaces for accessing the security features. A validation module, implemented in the boot code of the SoC for example, manages security certificates to control access to the plurality of security features. Each security certificate includes one or more unique identifiers corresponding to one or more hardware modules in the SoC and access control settings for one or more security features of the one or more hardware modules. The security certificate additionally includes a certificate signature signed by a secure key.

BRIEF SUMMARY

The object of the present application is solved by the independent claims. Advantageous embodiments are described by the dependent claims. According to some embodiments, an integrated circuit includes a control circuit, a one-time programmable circuit, and a security feature. The control circuit determines if the one-time programmable circuit is programmed in response to a request by a user of the integrated circuit to access the security feature. The control circuit generates a signal to indicate to the user of the integrated circuit that the security feature has been previously accessed if the control circuit determines that the one-time programmable circuit has been programmed to indicate a previous access to the security feature. The control circuit causes the one-time programmable circuit to be programmed in response to the request if the control circuit determines that the one-time programmable circuit has not been programmed.
Various objects, features, and advantages of the present invention will become apparent upon consideration of the following detailed description and the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 illustrates an example of a security feature access system, according to an embodiment.
Figure 2 is a flow chart that shows examples of operations that may be performed to clear a security feature access register, according to an embodiment.
Figure 3 is a flow chart that illustrates examples of operations that may be performed to determine if an integrated circuit (IC) will allow a user to access a security feature, according to an embodiment.
Figure 4 is a flow chart that illustrates examples of operations that may be performed to determine if an IC will allow a user to access a security feature, according to another embodiment.
Figure 5 illustrates an example of another security feature access system, according to a further embodiment.
Figure 6 is a flow chart that illustrates examples of operations for determining if a programmable integrated circuit (IC) has been previously configured, according to an embodiment.
Figure 7 is a flow chart that illustrates examples of operations that determine if a programmable integrated circuit (IC) has been previously programmed, according to another embodiment.
Figure 8 is a flow chart that illustrates other examples of operations that determine if a programmable integrated circuit (IC) has been previously programmed, according to a further embodiment.

DETAILED DESCRIPTION

Field programmable gate array (FPGA) integrated circuits (also referred to as devices) are often used in critical commercial, industrial, and military infrastructure; and therefore, they may be subject to attack by hostile adversaries. An attack may be intended to damage an FPGA device, to cause the device to fail prematurely due to life-time stress conditions, or to make a deployed device more susceptible to future attacks.
For example, the test mode of an FPGA device could be used to deliberately over-stress certain transistors in the FPGA device, making the transistors susceptible to premature negative bias temperature instability (NBTI) effects. These effects could be used to imprint static random access memory (RAM) or registers in the FPGA device, causing them to power-up to a known state that is favorable to an attacker.
Another form of an attack involves intercepting secrets that are stored in the FPGA, such as encryption keys. These secrets stored in the FPGA device may be protected by unique values in the FPGA device, such as unique values created by physically unclonable functions (PUPs). These values may need to be known by the end user of the FPGA before deploying the device, but the end user would want to prevent an attacker from extracting the secret before or after the FPGA is deployed, because an attacker might intercept the FPGA anywhere along its supply chain. Other forms of tampering may have less malicious motivation, but still need to be protected against. For example, the reselling of previously used (and thus partially stressed and worn-out) FPGA devices as new and fresh FPGA devices would also have the effect of causing the FPGA devices to unexpectedly fail prematurely in their second application.
According to some embodiments disclosed herein, a security feature of an integrated circuit (IC) is protected by a one-time programmable circuit. A control circuit may allow a user access to the security feature of the IC based on the state of the one-time programmable circuit. The control circuit may prevent a user from accessing the security feature of the IC based on the state of the one-time programmable circuit. The security feature may be, for example, an encryption key, a physically unclonable function (PUF), a secure storage area of the IC, a test mode of the IC, a configuration mode of an FPGA, or a user mode of an IC. The security feature may also be referred to as a secure feature.
In some embodiments, the control circuit may allow a user to access the security feature of the IC only until the next power on reset of the IC that occurs after the one-time programmable circuit has been programmed by setting a security feature access register. After the next power on reset of the IC, the IC clears the security feature access register to a cleared state. In response to the security feature access register being in a cleared state, the control circuit prevents a user from accessing the security feature of the IC. The security feature access register may, for example, remain in a cleared state indefinitely, or the security feature access register may be set again by another one-time programmable circuit. Figures 1-4 illustrate some examples of these embodiments.
Figure 1 illustrates an example of a security feature access system 100, according to an embodiment. The security feature access system 100 of Figure (FIG.) 1 includes a control circuit 101, a security feature access register circuit 102, a one-time programmable circuit 103, and a security feature 104. Security feature access system 100, including circuits 101-104, may be located entirely within an integrated circuit (IC). The IC may be, for example, an FPGA, a programmable logic device (PLD), a programmable logic array (PLA), a processor, a memory device, an analog device, or any other type of IC. Control circuit 101 may be, for example, a state machine, a processor circuit, a portion of a processor circuit, programmable logic circuits programmed to function as a controller, or another type of control circuit.
System 100 supports two-way communication between control circuit 101 and each of security feature access register 102, one-time programmable circuit 103, and security feature 104, as shown by arrows in FIG. 1. System 100 may also support two-way communication between one-time programmable circuit 103 and security feature 104 as shown in FIG. 1. Security feature access register 102 is a volatile storage circuit that may include, for example, one or more flip-flop circuits.
Security feature 104 may be, for example, a secure storage area of an IC, a test mode of an IC, a configuration mode of a programmable IC, a user mode of an IC, the programmable logic circuits of a programmable logic IC, an encryption key, a physically unclonable function (PUF), to name a few examples. A PUF is on-die circuitry that uses non-reproducible manufacturing variations of the IC die to produce a function that is a unique and unclonable function in every IC die. A PUF can be used to generate a challenge-response pair. The input to a PUF is the challenge, and the output of the PUF is the response. The challenge and the response may each be, for example, hundreds or thousands of bits. PUPs can be used to protect encryption keys. A secret PUF can be used to hide an encryption key, for example, by XORing the encryption key with the PUF response to generate an output key. The original encryption key can be extracted from the output key by XORing the output key with the PUF response. A PUF can also be used to generate an encryption key.
Security feature 104 may be any type of PUF. Two examples of PUFs are an arbiter PUF and a static-RAM PUF. An arbiter PUF is a PUF that uses the difference between the delays of two different signal paths in an IC die that is caused by manufacturing variations of an individual IC die. A static-RAM PUF is a PUF that is based on individual memory cells of an SRAM circuit in an IC powering up to random states.
A PUF may be a soft PUF or a hard PUF. Hard PUFs are implemented directly into the silicon of an IC. Soft PUFs are implemented by configuring programmable resources in an IC, such as lookup tables, registers, and memories. Both static RAM and arbiter PUFs can be implemented as hard PUFs or as soft PUFs using programmable resources in a programmable IC.
In an embodiment, security feature 104 may be, for example, the combination of a soft PUF implemented by programmable resources in a programmable IC and a configuration mode of the programmable IC. The combination of the soft PUF and the configuration mode as the security feature 104 protects against attacks on the soft PUF. In this embodiment, the state of one-time programmable circuit 103 indicates if the IC has ever been configured before a user first received the IC. If the one-time programmable circuit 103 indicates that the IC has been configured before by another user, it is possible that an attacker may have intercepted the IC, programmed the soft PUF into the programmable resources, and read the PUF response. If the one-time programmable circuit 103 indicates that the IC has not been configured before by another user, the user can be confident that the user has gained sole knowledge of the PUF response. The user can then use the PUF response to create or protect an encryption key that prevents future configurations of the IC by anyone who does not correctly enter the encryption key. For example, a user may program the one-time programmable circuit 103 to cause the IC to require the correct entry of a PUF protected or created encryption key before the IC enters configuration mode and user mode. This embodiment prevents an attacker from subsequently gaining access to the PUF response.
One-time programmable circuit 103 may include, for example, one or more non-volatile, one-time programmable fuses (also referred to herein simply as fuses) and/or one or more non-volatile, one-time programmable antifuses (also referred to herein simply as antifuses). Each one-time programmable fuse has a conductive path that conducts current before the fuse is blown. After the fuse is blown (i.e., programmed), the conductive path is broken, and the fuse conducts little or no current through the previously conductive path. Each fuse can be programmed/blown only one time. A one-time programmable fuse may include a resistor that burns out when an over current, over load, or mismatched load connect event occurs. Each one-time programmable antifuse initially has a high resistance path that conducts little or no current until the antifuse is programmed. After the antifuse is programmed, the antifuse has a low resistance conductive path that conducts significantly more current. Each antifuse can be programmed only one time.
Figure 2 is a flow chart that shows examples of operations that may be performed to clear a security feature access register, according to an embodiment. In the embodiment of FIG. 2, the security feature access register 102 is cleared after a power on reset operation of the integrated circuit (IC) that contains the security feature access register 102 and the security feature 104. In operation 201, the IC performs a power on reset operation. A power on reset operation may occur each time the IC receives power (i.e., is powered up) after being powered off. In operation 202, control circuit 101 clears the security feature access register 102. Control circuit 101 may clear the security feature access register 102 by causing the bit (or bits) stored in the security feature access register 102 to have a predefined clear value. The predefined clear value is a known value that may be, e.g., a logic low state, a logic high state, or a predefined set of bit values if register 102 stores multiple bits.
Figure 3 is a flow chart that illustrates examples of operations that may be performed to determine if an IC will allow a user to access a security feature, according to an embodiment. In the embodiment of FIG. 3, one-time programmable circuit 103 includes a one-time programmable disable circuit and a one-time programmable enable circuit. The one-time programmable disable and enable circuits of FIG. 3 can be fuses, antifuses, or any combination of one or more fuses and one or more antifuses. In the embodiment of FIG. 3, control circuit 101 allows a user of the IC to access the security feature 104 only if the one-time programmable disable circuit is not programmed, and the one-time programmable enable circuit is programmed. If both the one-time programmable disable and enable circuits are not programmed, control circuit 101 may optionally cause the one-time programmable enable circuit to be programmed automatically. The one-time programmable enable circuit may be used as a future indicator that the security feature 104 has been previously accessed. Granting access to security feature 104 may include setting the security feature access register 102 to a predefined access value, which will allow a user to access security feature 104 at least until the next power on reset event in the IC.
In operation 301, control circuit 101 receives a request to access the security feature 104. The request may be generated in response to input from a user of the IC requesting access to security feature 104. In operation 302, control circuit 101 determines if the bit (or bits) stored in the security feature access register 102 is set to the access value. The access value may be, e.g., the opposite logic state as the predefined clear value. If the bit (or bits) stored in the security feature access register 102 is set to the access value at operation 302, control circuit 101 grants the user access to security feature 104 in operation 308 as shown in FIG. 3.
If the bit (or bits) stored in the security feature access register 102 is not set to the access value at operation 302, control circuit 101 proceeds to operation 303. In operation 303, control circuit 101 determines if the one-time programmable disable circuit is programmed. If the one-time programmable disable circuit is programmed at operation 303, control circuit 101 asserts a failure signal in operation 309, and control circuit 101 prevents a user of the IC from accessing the security feature 104. A user interface may provide a message to the user in response to the failure signal generated in operation 309 to indicate that a failure has occurred and/or that the security feature 104 cannot be accessed. The control circuit 101 may cause the one-time programmable disable circuit to be programmed to prevent a user from accessing the security feature 104, for example, in response to user input or in response to a user accessing the security feature 104.
A one-time programmable circuit may prevent a user from accessing a security feature, for example, by physically blocking signal access to the security feature when the one-time programmable circuit is programmed. Signal access to security feature 104 may, for example, be routed through one-time programmable circuit 103, e.g., via a two-way communication path between circuits 103 and 104. When the one-time programmable disable circuit in circuit 103 is programmed, the output of the one-time programmable disable circuit may, for example, cause one or more logic gate circuits to block any signal access to security feature 104.
As another example, all accesses to security feature 104 may be routed through control circuit 101. In this example, control circuit 101 may prevent access to security feature 104 in response to detecting that the one-time programmable disable circuit is programmed. After the one-time programmable disable circuit is programmed, control circuit 101 blocks all accesses by a user of the IC to security feature 104.
If the one-time programmable disable circuit is not programmed at operation 303, control circuit 101 proceeds to operation 304. In operation 304, control circuit 101 determines if the one-time programmable enable circuit is programmed. If the one-time programmable enable circuit is programmed at operation 304, control circuit 101 grants the user access to security feature 104 in operation 308 as shown in FIG. 3. Control circuit 101 may also optionally indicate to the user that the security feature 104 has been previously accessed. If the one-time programmable enable circuit is not programmed at operation 304, control circuit 101 causes the one-time programmable enable circuit to be programmed in operation 305.
In operation 306, control circuit 101 again determines if the one-time programmable enable circuit is programmed. If control circuit 101 determines that the one-time programmable enable circuit is not programmed at operation 306, control circuit 101 asserts the failure signal in operation 309 as shown in FIG. 3 and prevents the user from accessing the security feature 104. If control circuit 101 determines that the one-time programmable enable circuit is programmed at operation 306, control circuit 101 sets the security feature access register 102 to the access value in operation 307. Control circuit 101 then grants the user access to the security feature 104 in operation 308 as shown in FIG. 3. Control circuit 101 allows the user to access the security feature 104 additional times by implementing additional iterations of operations 301-302 and 308 until the next power on reset of the IC. After the next power on reset of the IC, the security feature access register 102 is cleared to the clear value as disclosed herein with respect to FIG. 2.
According to some embodiments of the present invention, security in an IC is improved by disabling access to one or more security features of the IC, such as test mode, configuration of a programmable IC, user mode, or access to certain security areas, such as encryption keys or the output of hard or soft PUF circuitry, before or after one or more non-volatile, one-time programmable circuits are programmed. Control circuit 101 may detect if the one or more one-time programmable circuits have been previously programmed to deny or grant access to the security feature.
As discussed above, some previously known integrated circuits (ICs) have a test disable bit that can be set to disable access to a test mode. However, many manufacturers are unwilling to set this test disable bit for all customers, because doing so would prevent the failure analysis of any IC returned from the field. On the other hand, with these previously known ICs, if the manufacturer selectively sets the test disable bit for some customers, but sold some ICs without the test disable bit being set, users who received an IC that did not have the test disable bit set would be able to enter test mode, set the test disable bit, and subsequently reintroduce the IC into the supply chain. Users who care about the security of their ICs would not be able to distinguish these tampered ICs from ICs that were not tampered with. Manufacturers may have similar problems in controlling access to other security features of their ICs.
According to an exemplary embodiment, control circuit 101 of FIG. 1 prevents undetected access to a test mode of an IC. In this exemplary embodiment, access to the test mode by a user of the IC is controlled based on the states of two one-time programmable enable circuits and two one-time programmable disable circuits. This embodiment may, for example, be implemented by two iterations of the operations shown in FIG. 3. In this embodiment, access to the features of the test mode by a user of the IC is prevented until the first one-time programmable enable circuit is programmed, e.g., in the first iteration of operation 305. Access to the test mode can be temporarily disabled by programming the first one-time programmable disable circuit. Control circuit 101 prevents the user from accessing test mode if the first or second one-time programmable disable circuit is programmed, as disclosed with respect to operations 303 and 309. Access to the test mode of the IC by a user can then be re-enabled by programming the second one-time programmable enable circuit, e.g., in the second iteration of operation 305 after a power on reset of the IC. Access to the test mode of the IC by a user can then be permanently prevented by programming the second one-time programmable disable circuit. If the second one-time programmable enable circuit is not programmed when the second one-time programmable disable circuit is programmed, the second one-time programmable enable circuit cannot be programmed after the second one-time programmable disable circuit is programmed.
The original states of the one-time programmable circuits (as of the time the IC is powered-on) are made accessible to designs implemented by the IC (e.g., designs programmed into an FPGA) and to users of the IC (e.g., through JTAG ports). The manufacturer responsible for functionality tests of the IC is then able to detect if an IC has been intercepted and if the test mode of the IC has been accessed anywhere along the prior supply chain by checking if the first one-time programmable enable circuit was previously programmed by someone other than the functionality tester. The manufacturer may then respond appropriately (e.g., by marking or destroying the IC). After the IC has been tested, the manufacturer programs the first one-time programmable disable circuit and reintroduces the IC into the supply or sales chain. When a user receives the IC from the supply chain, the user (or the user's design that is programmed into the FPGA) can check that the first one-time programmable disable circuit is programmed, and that the second one-time programmable enable circuit is not programmed. If the second one-time programmable enable circuit has been programmed, the user is then able to detect that the test mode of the IC has been accessed somewhere along the supply chain after having left the functionality testing facility of the manufacturer. The user can then respond appropriately (e.g., return the device to the manufacturer). If the user so chooses, and does not want the ability to return the IC to the manufacturer for possible future failure analysis, the user can program the second one-time programmable disable circuit to permanently disable the test mode of the IC.
Other security-related features can be implemented in a similar manner. For example, separate PUF access enable and disable one-time programmable circuits may allow access to a response generated by a PUF in an IC in response to a challenge input. The PUF access enable and disable one-time programmable circuits control secure access to an encryption key generated from a PUF response. As another example, separate configuration enable and disable one-time programmable circuits for a programmable IC may allow access to user configuration of the IC. The configuration enable/disable one-time programmable circuits ensure that a user of the programmable IC is receiving a new IC, as opposed to a "grey market" IC that had been previously used.
Figure 4 is a flow chart that illustrates examples of operations that may be performed to determine if an IC will allow a user to access a security feature, according to another embodiment. In the embodiment of FIG. 4, one-time programmable circuit 103 can include one or more fuses, one or more antifuses, or a combination of one or more fuses and one or more antifuses. In the embodiment of FIG. 4, granting access to security feature 104 includes setting the security feature access register 102 to a predefined access value to allow a user to access security feature 104 at least until the next power on reset event in the IC. The one-time programmable circuit 103 being programmed is an indicator that the security feature 104 has been previously accessed.
In operation 401, control circuit 101 receives a request to access the security feature 104. The request may be generated in response to input from a user requesting access to security feature 104. In operation 402, control circuit 101 determines if the bit (or bits) stored in the security feature access register 102 is set to the access value. If the bit (or bits) stored in the security feature access register 102 is set to the access value at operation 402, control circuit 101 grants the user access to security feature 104 in operation 407 as shown in FIG. 4.
If the bit (or bits) stored in the security feature access register 102 is not set to the access value at operation 402, control circuit 101 proceeds to operation 403. In operation 403, control circuit 101 determines if the one-time programmable circuit 103 is programmed. If the one-time programmable circuit 103 is programmed at operation 403, control circuit 101 asserts a failure signal in operation 408 and prevents the user from accessing the security feature 104. A user interface may provide a message to the user in response to the failure signal to indicate that a failure has occurred and/or that the security feature 104 cannot be accessed. Control circuit 101 may cause the one-time programmable circuit 103 to be programmed to prevent a user from accessing the security feature 104 after the next power on reset of the IC, for example, in response to a user accessing the security feature 104.
If the one-time programmable circuit 103 is not programmed at operation 403, control circuit 101 proceeds to operation 404. In operation 404, control circuit 101 causes the one-time programmable circuit 103 to be programmed. In operation 405, control circuit 101 again determines if the one-time programmable circuit 103 is programmed. If control circuit 101 determines that the one-time programmable circuit 103 is not programmed at operation 405, control circuit 101 asserts the failure signal in operation 408 as shown in FIG. 4 and prevents the user from accessing the security feature 104.
If control circuit 101 determines that the one-time programmable circuit 103 is programmed at operation 405, control circuit 101 sets the security feature access register 102 to the access value in operation 406. Control circuit 101 then grants the user access to the security feature 104 in operation 407 as shown in FIG. 4. Control circuit 101 grants the user additional accesses to the security feature 104 by implementing additional iterations of operations 401-402 and 407 until the next power on reset of the IC. After the next power on reset of the IC, the security feature access register 102 is cleared to the clear value as disclosed herein with respect to FIG. 2, and then the control circuit 101 does not allow any user of the IC any additional accesses to the security feature 104.
Figure 5 illustrates an example of a security feature access system 500, according to another embodiment. The security feature access system 500 of FIG. 5 includes a configuration control circuit 501, a one-time programmable circuit 502, and programmable logic and routing circuits 503. Security feature access system 500, including circuits 501-503, may be located entirely within a programmable integrated circuit (IC). The IC may be, for example, an FPGA, a PLD, a PLA, or another type of programmable IC. Programmable logic and routing circuits 503 are programmable resources of a programmable IC. Configuration control circuit 501 may be, for example, a state machine, a processor circuit, a portion of a processor circuit, or another type of control circuit. System 500 supports two-way communication between control circuit 501 and each of one-time programmable circuit 502 and programmable logic and routing circuits 503, as shown by arrows in FIG. 5. One-time programmable circuit 502 can include one or more fuses, one or more antifuses, or a combination of one or more fuses and one or more antifuses. The programmable logic and routing circuits 503 may include an array of programmable logic circuits and programmable routing circuits (e.g., multiplexers) that controls a network of routing conductors to interconnect the programmable logic circuits.
In the embodiment of Figure 5, the security feature protected by the one-time programmable circuit 502 is a configuration mode of the programmable IC, and thus access to the programmable logic and programmable routing circuits 503 of the IC. One-time programmable circuit 502 is used to control access to the configuration mode of the programmable IC. During the configuration mode, programmable logic and programmable routing circuits 503 in the programmable IC are configured with a configuration bitstream that is loaded into the IC from an external source. The programmable IC is configured with the configuration bitstream during the configuration mode to implement a user design for the IC. Configuration control circuit 501 controls access to the configuration mode of the IC. Thus, the configuration control circuit 501 also controls user access to the programmable logic and programmable routing circuits 503. Configuration control circuit 501 may allow a user to cause the programmable IC to enter configuration mode to configure the programmable IC if the one-time programmable circuit 502 is programmed. The control circuit 501 may prevent the programmable IC from entering configuration mode if the one-time programmable circuit 502 is not programmed. Figures 6-8 illustrate operations that may be performed using system 500 according to various embodiments.
Figure 6 is a flow chart that illustrates examples of operations for determining if a programmable integrated circuit (IC) has been previously configured, according to an embodiment. FIG. 6 shows the supply chain flow when a user first receives an ostensibly new programmable IC from a distributer. The operations of FIG. 6 allow a user to determine if the programmable resources of the programmable IC have ever been configured before by checking the state of the one-time programmable circuit 502. The programmable resources of the programmable IC may be configured in a configuration mode and then subsequently utilized in a user mode. If the programmable IC has already been configured, the user may return the IC to the manufacturer and mark the IC as used, or discard the IC. If the IC has not been configured previously, the user may optionally program the one-time programmable circuit 502 and proceed with configuring the IC. The one-time programmable circuit 502 is not programmed when the manufacturer powers up the IC into a test mode. The programmable IC as discussed with respect to FIGS. 6-8 may be, for example, an FPGA, a PLD, a PLA, or even an application specific integrated circuit (ASIC) that has some programmable features.
In FIGS. 6-8, the security feature may, as an example, include the combination of a soft PUF implemented by the programmable resources and a configuration or user mode of the programmable IC. The combination of the soft PUF and the configuration/user mode as the security feature protects against attacks on the soft PUF, as described above. The state of one-time programmable circuit 502 indicates if the IC has ever been configured before a user first receives the IC.
After a user receives a programmable IC from a distributer, the user powers up the programmable IC. In operation 601, an attempt is made to access configuration mode or user mode after the programmable IC has powered up, as shown in FIG. 6. The attempt to access the configuration mode or user mode in operation 601 may occur in response to user input, or the programmable IC may automatically attempt to enter configuration mode or user mode after the IC powers up. In operation 602, the configuration control circuit 501 determines if the one-time programmable circuit 502 (e.g., that has a fuse and/or an antifuse) is programmed in response to the attempt in operation 601. If the configuration control circuit 501 determines that the one-time programmable circuit 502 is programmed in operation 602, then the control circuit 501 may assert an error signal in operation 603. A user interface may indicate to the user that the programmable IC has already been configured in response to the error signal that is asserted in operation 603. The user may then optionally decide to return the programmable IC, discard the programmable IC, or continue with configuring the programmable IC.
If the configuration control circuit 501 determines that the one-time programmable circuit 502 is not programmed in operation 602, the user of the IC may optionally decide to program circuit 502 in operation 604. If the user decides to program circuit 502 after operation 602, the user may enter input into a user interface, and then in response to the user input, a control signal is sent to the control circuit 501. In response to receiving this control signal, control circuit 501 causes the one-time programmable circuit 502 to be programmed (e.g., blow a fuse) in operation 604. Control circuit 501 then proceeds to operation 605. In operation 605, control circuit 501 asserts a signal to indicate that the user may add the programmable IC to the user's inventory. The user interface may display a message to the user in response to the signal asserted in operation 605. The message may indicate that the user can add the programmable IC to the user's inventory.
Figure 7 is a flow chart that illustrates operations that determine if a programmable integrated circuit (IC) has been previously programmed, according to an embodiment. Control circuit 501 checks if the programmable resources of the programmable IC have ever been previously configured by a user whenever an attempt is made to configure the programmable IC. The programmable IC cannot be configured until the one-time programmable circuit 502 is programmed. Therefore, the one-time programmable circuit 502 being in a programmed state indicates that the programmable IC has been previously configured. The operations of FIG. 7 may occur after operation 604 of FIG. 6. In the embodiments of FIGS. 6-7, one-time programmable circuit 502 may include one or more fuses, one or more antifuses, or a combination of one or more fuses and one or more antifuses.
In operation 701, the programmable IC receives a request from the user to configure the programmable IC and/or to enter the configuration mode. The request is routed to the configuration control circuit 501. In operation 702, the configuration control circuit 501 determines if the one-time programmable circuit 502 is programmed in response to receiving the request in operation 701. If the configuration control circuit 501 determines that the one-time programmable circuit 502 is not programmed in operation 702, then the control circuit 501 asserts an error signal in operation 704. The error signal generated in operation 704 indicates that circuit 502 is not programmed.
In response to the error signal generated in operation 704, a user interface may indicate to the user that circuit 502 is not programmed and that circuit 502 must be programmed in order to proceed to the configuration mode of the IC. The user interface may display to the user an option to program circuit 502 in response to the error signal generated in operation 704. If the user chooses the option to program circuit 502, control circuit 501 causes circuit 502 to be programmed, and then circuit 501 repeats operation 702. If the user does not choose the option to program circuit 502, control circuit 501 may prevent the programmable IC from entering configuration mode and user mode. The programmable IC can only be configured with a user's design in the configuration mode. Therefore, preventing the programmable IC from entering the configuration mode prevents a user from configuring the programmable IC.
Alternatively, control circuit 501 may automatically cause one-time programmable circuit 502 to be programmed in response to determining that circuit 502 is not programmed in operation 702. Control circuit 501 then repeats operation 702 to confirm that one-time programmable circuit 502 is programmed.
If the configuration control circuit 501 determines that the one-time programmable circuit 502 is programmed in operation 702, then the control circuit 501 proceeds to operation 703. In operation 703, control circuit 501 allows the programmable IC to enter configuration mode. During configuration mode, the programmable IC is configured to implement the user's design. Configuration control circuit 501 may also control the configuration of the programmable IC during or after operation 703.
After the programmable IC has been configured in the configuration mode, the programmable IC can enter a user mode during which the user's design that has been configured into the IC is used for its intended purpose. In an embodiment, the IC does not allow the user to enter user mode until the IC has been configured with a user design in the configuration mode. Thus, in this embodiment, the state of the one-time programmable circuit 502 also indicates whether the IC has ever entered the user mode.
Figure 8 is a flow chart that illustrates examples of operations that determine if a programmable integrated circuit (IC) has been previously configured, according to an embodiment. Control circuit 501 checks if the one-time programmable circuit 502 is programmed when an attempt is made to configure the programmable IC. If the one-time programmable circuit 502 is not programmed, then control circuit 501 automatically programs circuit 502. The programmable IC cannot be configured until the one-time programmable circuit 502 is programmed. Therefore, the one-time programmable circuit 502 being in a programmed state indicates that the programmable IC has been previously configured. The operations of FIG. 8 may occur after operation 604 of FIG. 6. In the embodiment of FIG. 8, one-time programmable circuit 502 may include one or more fuses, one or more antifuses, or a combination of one or more fuses and one or more antifuses.
Referring to FIG. 8, the programmable IC receives a request from the user to configure the programmable IC in operation 801. The request is routed to the configuration control circuit 501. In operation 802, the configuration control circuit 501 determines if the one-time programmable circuit 502 is programmed in response to receiving the request in operation 801. If the configuration control circuit 501 determines that the one-time programmable circuit 502 is programmed in operation 802, then the control circuit 501 allows the programmable IC to enter configuration mode in operation 805. During configuration mode, the programmable IC is configured to implement the user's design. Configuration control circuit 501 may also control the configuration of the programmable IC in configuration mode during or after operation 805.
If the configuration control circuit 501 determines that the one-time programmable circuit 502 is not programmed in operation 802, then the control circuit 501 proceeds to operation 803. In operation 803, control circuit 501 causes the one-time programmable circuit 502 to be programmed. The control circuit 501 then proceeds to operation 804. In operation 804, the control circuit 501 determines if the one-time programmable circuit 502 is programmed. If the control circuit 501 determines that the one-time programmable circuit 502 is programmed in operation 804, then the control circuit 501 allows the programmable IC to enter configuration mode in operation 805.
If the control circuit 501 determines that the one-time programmable circuit 502 is not programmed in operation 804, then the control circuit 501 asserts an error signal in operation 806. In response to the error signal asserted in operation 806, a user interface may indicate to the user that an error has occurred in attempting to program the one-time programmable circuit 502. The control circuit 501 may then prevent the programmable IC from entering configuration mode and user mode.
The methods and apparatuses described herein may be incorporated into any suitable electronic device or system of electronic devices. For example, the methods and apparatuses may be incorporated into numerous types of integrated circuits, such as programmable array logic (PAL), programmable logic arrays (PLAs), field programmable logic arrays (FPLAs), electrically programmable logic devices (EPLDs), electrically erasable programmable logic devices (EEPLDs), logic cell arrays (LCAs), field programmable gate arrays (FPGAs), application specific standard products (ASSPs), application specific integrated circuits (ASICs), digital signal processors (DSPs), microprocessors, and graphics processing units (GPUs).
The integrated circuits described herein may be part of a data processing system that includes one or more of the following components; a processor; memory; input/output circuitry; and peripheral devices. The integrated circuits can be used in a wide variety of applications, such as computer networking, data networking, instrumentation, video processing, digital signal processing, or any suitable other application.
Although the method operations were described in a specific order, it should be understood that other operations may be performed in between described operations, described operations may be adjusted so that they occur at slightly different times or in a different order, or described operations may be distributed in a system that allows the occurrence of the processing operations at various intervals associated with the processing.

Claims

An integrated circuit comprising:
a control circuit (101, 501);

a one-time programmable circuit (103, 502) comprising a one-time programmable disable circuit and a one-time programmable enable circuit; and

a security feature (104), wherein the control circuit (101, 501) determines if the one-time programmable disable circuit and the one-time programmable enable circuit are programmed in response to a request by a user of the integrated circuit to access the security feature (104), the control circuit (101, 501) causes the one-time programmable enable circuit to be programmed in response to the request to access the security feature (104), and the control circuit (101, 501) generates a signal to indicate to the user of the integrated circuit that the security feature (104) has been previously accessed if the control circuit (101, 501) determines that the one-time programmable enable circuit has been programmed,

wherein the control circuit (101, 501) causes the one-time programmable enable circuit to be programmed in response to the request if the control circuit (101, 501) determines that the one-time programmable enable circuit has not been programmed, and

wherein the control circuit (101, 501) prevents a user of the integrated circuit from accessing the security feature (104) if the control circuit (101, 501) determines that the one-time programmable disable circuit has been programmed.
The integrated circuit of claim 1, wherein the security feature (104) is at least one of circuitry that implements a physically unclonable function in the integrated circuit, a storage circuit in the integrated circuit that stores secure information, programmable logic circuits in the integrated circuit, or programmable routing circuits in the integrated circuit.
The integrated circuit of claim 1, wherein the security feature (104) is at least one of a configuration mode of the integrated circuit, a test mode of the integrated circuit, an encryption key, or secure data stored in the integrated circuit.
The integrated circuit of claim 1, wherein the one-time programmable circuit (103, 502) comprises at least one fuse, at least one antifuse, or any combination of fuses and antifuses.
The integrated circuit of claim 1 further comprising:
a security feature access register (102), wherein the control circuit (101, 501) causes an access value to be stored in the security feature access register (102) after causing the one-time programmable enable circuit to be programmed, and wherein the control circuit (101, 501) only allows a user of the integrated circuit to access the security feature (104) when the security feature access register (102) is set to the access value.
The integrated circuit of claim 5, wherein the control circuit (101, 501) clears the security feature access register (102) to a clear value in response to the integrated circuit being powered up after being powered off.
The integrated circuit of claim 1, wherein the control circuit (101, 501) allows a user of the integrated circuit to access the security feature (104) after programming the one-time programmable circuit (103, 502) and before a next power on reset of the integrated circuit.
A method for protecting security features of an integrated circuit comprising a control circuit (101, 501) and a one-time programmable circuit (103, 502) comprising a one-time programmable disable circuit and a one-time programmable enable circuit, the method comprising:
determining if the one-time programmable disable circuit and the one-time programmable enable circuit are programmed using the control circuit (101, 501) in response to a request by a user of the integrated circuit to access a security feature (104);

causing the one-time programmable enable circuit to be programmed in response to the request to access the security feature (104);

generating a signal to indicate to the user of the integrated circuit that the security feature (104) has been previously accessed if the control circuit (101, 501) determines that the one-time programmable enable circuit has been programmed;

causing the one-time programmable enable circuit to be programmed in response to the request if the control circuit (101, 501) determines that the one-time programmable enable circuit has not been programmed; and

preventing a user of the integrated circuit from accessing the security feature (104) if the control circuit (101,501) determines that the one-time programmable disable circuit has been programmed.
The method of claim 8, wherein the security feature (104) is at least one of circuitry that implements a physically unclonable function in the integrated circuit, a storage circuit in the integrated circuit that stores secure information, programmable logic circuits in the integrated circuit, programmable routing circuits in the integrated circuit, a configuration mode of the integrated circuit, a test mode of the integrated circuit, an encryption key, or secure data stored in the integrated circuit.
The method of claim 8, wherein the one-time programmable circuit (103, 502) comprises at least one fuse, at least one antifuse, or a combination of at least one fuse and at least one antifuse.
The method of claim 8 further comprising:
preventing a user of the integrated circuit from accessing the security feature (104) if the control circuit (101, 501) determines that the one-time programmable disable circuit has been previously programmed by another user.
The method of claim 8 further comprising:
with the control circuit (101, 501), causing an access value to be stored in a security feature access register (102) after the control circuit (101, 501) causes the one-time programmable enable circuit to be programmed;

with the control circuit (101, 501), allowing a user of the integrated circuit to access the security feature (104) only when the security feature access register (102) is set to the access value; and

with the control circuit (101, 501), clearing the security feature access register (102) to a clear value in response to the integrated circuit being powered up after being powered off.